Yeah, I think the latter is more likely than the former. Perhaps a server side bug that's silently downloading the app on any device that's installed it previously?
It shouldn’t do that, obviously, but headspace does seem like it’s one that bundles “free” with a bunch of health insurance, education, etc.
From a debugging perspective, without having Apples information, I kinda want to know if all affected users have some related health or education apps.
It’s a locked-down platform - slightly less so if you’re in the EU.
It only happened one time though. After I uninstalled it, it never came back.